Every CVE Search/ Get API key

CVE-2017-16844

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22...

9.8 CriticalFix available

CVE-2017-16844 is a critical vulnerability (CVSS 9.8) in Procmail, published November 16, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.2%, the 96th percentile. Fixed in procmail 3.22-53.

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

12.2%Up 8.8 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
CVE-2017-16844
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
CVE-2017-16844
Updated
2026-11-02
EUVDEUVD-2017-8018 No score

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
EUVD-2017-8018
Updated
2026-11-03
GitHub AdvisoriesGHSA-4f62-c8fw-44pp 9.8

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22...

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
GHSA-4f62-c8fw-44pp
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVAZL-36982 9.8

CVE-2017-16844 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
AZL-36982
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVAZL-6803 9.8

CVE-2017-16844 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
AZL-6803
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 9 moreShow less
OSVAZL-7332 9.8

CVE-2017-16844 affecting package procmail for versions less than 3.22-53

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
AZL-7332
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 9.8

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
CVE-2017-16844
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-16844 9.8

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
DEBIAN-CVE-2017-16844
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:3269 7.5

Red Hat Security Advisory: procmail security update

Record
RHSA-2017:3269
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-16844 9.8

Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618.

Record
UBUNTU-CVE-2017-16844
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11194-1 No score

procmail-3.22-277.3 on GA media

These are all security issues fixed in the procmail-3.22-277.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11194-1
Updated
2026-11-02
OSVSUSE-SU-2017:3231-1 No score

Security update for procmail

This update for procmail fixes the following issues:

Security issue fixed:

  • CVE-2017-16844: Heap-based buffer overflow in the loadbuf function in formisc.c in formail in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message because of a hardcoded realloc size, a different vulnerability than CVE-2014-3618. (bnc#1068648)
Record
SUSE-SU-2017:3231-1
Updated
2026-11-02
OSVSUSE-SU-2018:0173-1 No score

Security update for procmail

This update for procmail fixes the following issues:

  • CVE-2017-16844: Heap-based buffer overflow in loadbuf function could lead to remote denial of service (bsc#1068648)
Record
SUSE-SU-2018:0173-1
Updated
2026-11-02
OSVUSN-3483-1 No score

procmail vulnerability

Jakub Wilk discovered that the formail tool incorrectly handled certain malformed mail messages. An attacker could use this flaw to cause formail to crash, resulting in a denial of service, or possibly execute arbitrary code.

Record
USN-3483-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
procmail
Azure Linux:3
 before 3.22-53
3.22-53
procmail
Azure Linux:2
 before 3.22-53
3.22-53
procmail
Debian:12
 before 3.22-26
3.22-26
procmail
Debian:13
 before 3.22-26
3.22-26
procmail
Debian:14
 before 3.22-26
3.22-26
procmail
Debian:7
 before 3.22-20+deb7u2, plus listed versions
3.22-203.22-20+deb7u1
3.22-20+deb7u2
procmail
Debian:8
 before 3.22-24+deb8u1, plus listed versions
3.22-24
3.22-24+deb8u1
procmail
Debian:9
 before 3.22-25+deb9u1, plus listed versions
3.22-25
3.22-25+deb9u1
procmail
Red Hat:enterprise_linux:7::client
 before 0:3.22-36.el7_4.1
0:3.22-36.el7_4.1
procmail-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.22-36.el7_4.1
0:3.22-36.el7_4.1
Show 16 moreShow less
Affected packages
PackageAffectedFixed
procmail
Red Hat:enterprise_linux:7::server
 before 0:3.22-36.el7_4.1
0:3.22-36.el7_4.1
procmail-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.22-36.el7_4.1
0:3.22-36.el7_4.1
procmail
Red Hat:enterprise_linux:7::workstation
 before 0:3.22-36.el7_4.1
0:3.22-36.el7_4.1
procmail-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.22-36.el7_4.1
0:3.22-36.el7_4.1
procmail
SUSE:Linux Enterprise Server 11 SP4
 before 3.22-240.8.3.1
3.22-240.8.3.1
procmail
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 3.22-240.8.3.1
3.22-240.8.3.1
procmail
SUSE:Linux Enterprise Desktop 12 SP2
 before 3.22-269.3.5
3.22-269.3.5
procmail
SUSE:Linux Enterprise Desktop 12 SP3
 before 3.22-269.3.5
3.22-269.3.5
procmail
SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2
 before 3.22-269.3.5
3.22-269.3.5
procmail
SUSE:Linux Enterprise Server 12 SP2
 before 3.22-269.3.5
3.22-269.3.5
procmail
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
 before 3.22-269.3.5
3.22-269.3.5
procmail
SUSE:Linux Enterprise Server 12 SP3
 before 3.22-269.3.5
3.22-269.3.5
procmail
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.22-269.3.5
3.22-269.3.5
procmail
Ubuntu:14.04:LTS
 before 3.22-21ubuntu0.2, plus listed versions
3.22-203.22-213.22-21ubuntu0.1
3.22-21ubuntu0.2
procmail
Ubuntu:16.04:LTS
 before 3.22-25ubuntu0.16.04.1, plus listed versions
3.22-25
3.22-25ubuntu0.16.04.1
procmail
openSUSE:Tumbleweed
 before 3.22-277.3
3.22-277.3

History

History
WhenChangedSources
2026-11-03aliasesEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 14 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open